Skip to main content

Data Encryption & Key Management

Files.com encrypts stored customer data and supports encryption in transit. Whether a connection requires encryption depends on its protocol and customer-controlled settings. Encryption is reviewed annually as part of the Files.com SOC 2 Type II audit.

Encryption in Transit

Encrypted connections protect data while it travels between systems. Some customer-configured connections permit unencrypted transmission, including optional unencrypted FTP and certain Custom SMTP modes.

Web access is protected by HTTPS with TLS 1.2 or TLS 1.3 encryption. Insecure HTTP requests are automatically redirected to HTTPS.

FTPS over port 990 uses TLS from connection start. FTP over port 21 supports explicit TLS and requires encryption by default; customers can optionally allow insecure FTP. SFTP connections use SSH encryption.

API traffic is encrypted using HTTPS with TLS. Webhooks use TLS when their destination is configured with HTTPS.

For Custom SMTP, customers choose whether encryption is required before authentication or message delivery through the SSL Mode setting. Require SSL (Explicit) requires STARTTLS, while Require SSL (Implicit) uses TLS from connection start. The default, Use If Available, can send credentials and messages unencrypted when STARTTLS is unavailable until a certificate-verified STARTTLS connection succeeds. That connection automatically changes the saved setting to Require SSL (Explicit), unless a parent Child Site Management Policy controls it. TLS failures prevent delivery without an unencrypted fallback. Never Use explicitly disables TLS and sends credentials and messages unencrypted. Select a required mode when encryption must be enforced from the first connection.

Encryption at Rest

Customer file contents in Files.com Native Storage, including backups, are encrypted at rest using AES-256 encryption. For connected remote storage, review the storage provider's encryption and key-management controls separately.

Sensitive configuration data is also encrypted using AES-256 with randomly generated initialization vectors. This includes:

  • Cloud storage credentials (e.g., AWS S3, Azure Blob, Google Cloud Storage)
  • SMTP credentials
  • Active Directory / LDAP credentials
  • SSL certificate private keys
  • PGP/GPG private keys

Customer-Controlled File Encryption

On Power and Enterprise plans, GPG encrypts the file contents themselves, separately from encryption of the connection or Files.com Native Storage. An encrypted file can remain encrypted after delivery to another system; decrypting it requires the corresponding private key. Customer-supplied keys let your organization decide who can decrypt the resulting file.

Files.com supports three processing methods:

  • Manual encryption or decryption of selected files, without a folder setting or automation.
  • An explicit encryption or decryption step in Automations v2, without requiring a folder setting.
  • Folder processing that applies encryption, decryption, or recryption to incoming files. Automations v1 relies on this folder-based method.

Keys and access must fit the operation. Giving Files.com a private key so it can decrypt files authorizes the service to process the decrypted contents; encrypting a file with a recipient's public key does not require that recipient's private key. Review any independently configured folder processing alongside explicit automation steps, because the folder rules still apply to files arriving there.

See GPG/PGP for permissions, supported operations, and configuration. Key Lifecycle Rules explains supported key-lifecycle controls.

Encryption Scope and Validation

Transport encryption protects a connection. Storage encryption protects the stored copy. File encryption protects the contents of an encrypted file. These controls do not replace permissions or prevent an authorized recipient from retaining a decrypted copy.

Algorithm strength and formal module validation are also different claims. The FedRAMP cryptographic-module disclosure identifies the AWS-validated inherited control and the modules Files.com does not operate in a FIPS-validated configuration. AES-256 or TLS support alone must not be treated as platform-wide FIPS validation.

SSL Certificate Management

Customers using a custom domain may request a free SSL certificate from Files.com or provide their own certificate from a trusted provider.

Encryption Key Management

Files.com uses HashiCorp Vault to manage encryption keys and secrets internally. For encryption at rest, key management and escrow are handled using AWS-native services.